CISA Highlights the Value of Cyber Decoys. FortiDeceptor Puts Them to Work
Fortinet, Tuesday, October 6th, 2026
Fortinet ties CISA's new guidance on cyber decoys to how FortiDeceptor uses deception to detect and investigate intruders.
On September 16, CISA published 'Using Cyber Decoys to Strengthen Detection and Response,' its first guide dedicated to defensive decoys, which assumes adversaries will get in and recommends an environment where their activity gives them away.
Fortinet explains the gap it addresses: attackers using valid credentials and living off the land can look like legitimate users, while any interaction with a decoy is a strong signal because decoys have no business purpose.
The post covers CISA's terms, including honeypots, honeytokens, breadcrumbs and tripwires, the use of MITRE ATT&CK to place decoys where coverage gaps are widest, and how FortiDeceptor applies the guidance.